Report harness timeouts as TIMED_OUT, reply from daemon outer handler, add stall/timeout regression tests

[davidoj]

Replaces #3 and #4, whose main fixes landed in #5. This carries only the pieces #5 did not cover, rebased on current main.

What #5 already covered

• Budget: DJINN_MAX_TOTAL_TIMEOUT (default 300) and DJINN_SECURE_TIMEOUT_PER_TEST (default 6). Don't score slow-but-correct submissions as wrong #3's warmup-nondeterminism test passes on main unmodified.
• Dead-child stall: EOFError/OSError caught around recv() in both daemon loops, request_id stamped on every reply. All of Reply when a child dies instead of stalling the parent for the full budget #4's tests pass on main unmodified.

What this PR adds

1. A blown budget is TIMED_OUT, not FAILED / CRASHED

On main a parent-side "Daemon timed out" comes back as FAILED on the secure path (timeout text buried in per-test feedback) and CRASHED on the insecure path — indistinguishable from a wrong answer. #5's description says training should drop rather than zero a timed-out grade, but a caller could only do that by string-matching feedback. Both paths now return VerificationStatus.TIMED_OUT (already defined; already what the insecure verifier's own alarm reports).

Only subprocess_error is classified. That key is written by the daemon loops and the parent, never by submission code, so a submission cannot spoof a timeout via its own exception text. Per-test alarm timeouts inside a batch still score that test as failed, unchanged.

calc_reward is unaffected: it returns 1.0 iff PASSED, so TIMED_OUT scores exactly as FAILED/CRASHED did. verify_problem_consistency compares against PASSED only.

2. Daemon outer exception handler replies instead of only logging

The one piece of #4 not in main. The except Exception at the end of each daemon loop logged and sent nothing, so any unexpected exception (fork failure, pipe setup, …) cost the parent its whole budget. It now sends a best-effort Daemon error: … reply; the send is itself guarded, so a gone parent still yields only a log line.

3. Regression tests (#5 merged without any)

• djinn/tests/test_daemon_stall.py (from Reply when a child dies instead of stalling the parent for the full budget #4): dead child via os._exit and SIGKILL on both paths returns promptly; runaway code still bounded; correct code unaffected.
• djinn/tests/test_timeout_budget.py (adapted from Don't score slow-but-correct submissions as wrong #3): timeout classification, budget sanity, verdict stable across warmup, TIMED_OUT on secure and insecure, daemon recovers after a timed-out request.

Insecure-path tests skip on platforms where the daemon child cannot set RLIMITs (macOS: Failed to set memory limits). Fixtures set insecure_test_cases so the test_case_leak insecure verifier actually runs the probe instead of passing on zero leaked cases.

Deliberately not carried over from #3

• The 5s post-warmup clamp. It re-caps every steady-state grade at 5s regardless of the configured budget — the original 1s bug at a different number — and the wedged-daemon case it guarded against is mostly gone now that the stall is fixed.
• The max(10, …) floor. Moot with a 6s per-test cap.

Testing

Platform	Result
Linux, python:3.12-slim, unprivileged container	23 passed (stall + timeout + marker)
macOS, Python 3.12	21 passed, 2 skipped (insecure daemon cannot set RLIMITs)

On main, test_exceeded_budget_reports_timed_out_not_failed_secure fails with FAILED / "Daemon timed out" and the insecure analogue fails with CRASHED.

🤖 Generated with Claude Code

https://claude.ai/code/session_014rSFHpdtkVYpGAEafamz5R